blendrpool[.]xyz

blendrpool.xyz was registered through NiceNIC International Group Co., Limited on 21 February 2026. The domain is hosted behind Cloudflare’s network (ASN 13335) and resolves to the IP address 104.21.53.175, which is geolocated to the United States. Cloudflare’s DNS configuration uses the nameservers bayan.ns.cloudflare.com and karina.ns.cloudflare.com, and the service is delivering traffic over HTTP/3. The TLS certificate presented by the site is issued by Google Trust Services under the WE1 designation, indicating a valid, publicly trusted certificate chain.

The site’s only observable page title is “Just a moment…”, and no additional content has been captured. Threat intelligence classifies the domain as an investment‑related phishing campaign. It appears on a single security blocklist, PhishDestroy, and five of ninety‑three VirusTotal scanners have raised detections, confirming that at least a subset of security products consider the host malicious. The domain is currently taken offline, which may be the result of takedown actions or temporary hosting changes.

Based on the evidence, the infrastructure is typical of fast‑flux or abuse‑ready phishing sites that leverage Cloudflare’s CDN to hide the true origin and to obtain a reputable TLS certificate without exposing the attacker’s infrastructure. The lack of additional page content, combined with the generic “Just a moment…” title, suggests the site may have been used to deliver a redirect or a loading page prior to presenting a fraudulent investment offer. Because the domain is newly created (less than six months old) and is already flagged by multiple vendors, defenders should add the domain and its resolving IP address to blocklists, monitor DNS queries for the listed Cloudflare nameservers, and continue to watch for re‑use of the same IP range or certificate fingerprint in future campaigns.